A web developer wants to protect their new web application from a man-in-the-middle attack. Which of the following controls would best prevent an attacker from stealing tokens stored in cookies?
1) Using HTTPS instead of HTTP
2) Storing tokens in local storage instead of cookies
3) Encrypting the tokens before storing them in cookies
4) Implementing secure cookie attributes such as HttpOnly and Secure
